On June 13, as Benjamin Netanyahu ended his decade-long run as Israel’s prime minister, a Telegram channel dedicated to protesting him hummed with celebration.
“And now prison, go to prison,” read a short message below a photoshopped image of Mr. Netanyahu behind bars. The 7,000 followers of the Telegram channel quickly spread the message to other groups and social media apps.
The channel and the message were secretly part of an Iranian disinformation campaign, according to Israeli disinformation researchers. Over several months, Iranian agents had infiltrated small WhatsApp groups, Telegram channels and messaging apps that Israeli activists used for intimate discussions among dozens to thousands of people.
Once there, the agents shared polarizing images and text, and began to send direct messages to people within the groups. Their goal, most likely, was simply to cause trouble, and to make people in these otherwise trusting online communities wary of one another.
The first-of-its-kind discovery of the Iranian campaign by FakeReporter, an Israeli disinformation watchdog group, offers insight into how countries have miniaturized their disinformation campaigns in an effort to stay under the radar of tech companies that have become more aggressive in rooting them out.
Instead of speaking to broad audiences on Facebook or Twitter, these campaigns stir up antigovernment sentiment and gather information about activists’ protests and organization by focusing on smaller and more private communications on WhatsApp, Telegram and other encrypted chat apps. Because only the senders and receivers can see what is being discussed, the disinformation campaigns are hidden from the tech companies and the authorities.
A message on Telegram was quickly spread by the channel’s 7,000 followers to other groups and social media apps.
A message on Telegram was quickly spread by the channel’s 7,000 followers to other groups and social media apps.
“What was so smart and unprecedented about this was the way they moved through small group chats where no one would expect to find an Iranian agent,” said Achiya Schatz, director of FakeReporter. “They really gained people’s trust and slipped under the radar of Facebook, Twitter and all the other tech companies.”
Facebook, which owns WhatsApp, removed several of the WhatsApp accounts tied to Iran after The New York Times contacted it about the evidence collected by FakeReporter. A Facebook spokeswoman confirmed that the identified accounts were tied to previous Iranian activity that the company had removed this year.
“Iranian-based threat actors are some of the more persistent and well-resourced groups attempting to operate online, including on our platform,” the Facebook spokeswoman said.
FakeReporter’s researchers found that many of the images and memes the Iranians used came from Iranian sites, or could be linked back to Facebook and Twitter accounts with previous links to Iran. While researchers believe many countries have been doing this, the recent investigation was the first to detail how a government could burrow its way into small, online community groups and to show how disinformation campaigns operate on encrypted apps.
U.S. intelligence agencies are concerned that the same could be happening in the United States. Last week, the Justice Department said it was blocking access to three dozen websites linked to disinformation efforts by Iran. A U.S. intelligence official told The Times that the authorities were closely monitoring messaging groups on Telegram, WhatsApp and other apps for Iranian disinformation.
The apps are an ideal means for Iran to enter a closed group of people with similar viewpoints and spread divisive and extremist messages, said the intelligence official, who was not authorized to give interviews and spoke on the condition of anonymity. They were sharing memes, for example, that likened Mr. Netanyahu to Adolf Hitler — an offensive comparison that could prod some people into more extreme views and make others think their online groups had become too extreme.
“In these closed messaging groups, people tend to trust one another and share more freely because there is a feeling that they share the same politics, and that the app itself is secure and safe,” said Gonen Ben Itzhak, an Israeli lawyer who once worked for Israel’s Shin Bet intelligence agency. He was among dozens of Israelis who said the Iranian efforts had targeted them.
The people who unknowingly communicated with the Iranians said the pandemic and upheaval in Israeli politics had made them especially vulnerable to the disinformation.
To avoid large crowds during the pandemic, many Israelis participated in local protests for their town, city or even their block. To plan for them, Israelis formed neighborhood groups on WhatsApp, Telegram and other social media platforms. The groups could be joined by anyone. New members often connected by clicking on a link shared by a friend or posted to a public website. While some of the groups had a few dozen members, others had over 10,000.
The flurry made it easy for Iranians to join new groups and form their own, Mr. Schatz said. Once the Iranians had infiltrated one group, they could easily jump to dozens of others that were advertised among the group members. They could begin in a group dedicated to protests in a suburb of Jerusalem and within a day find themselves in groups dedicated to matters as various as vaccine hesitancy or ultra-Orthodox conspiracy theorists.
“People shared links to new groups within the channels all the time and invited others to join,” Mr. Schatz said. “The Iranians could walk into whatever group conversation they wanted.”
In early February, Nitzan Sztyglic, an Israeli activist, received a message from a stranger named Adam on WhatsApp. Like Mr. Sztyglic, the stranger appeared interested in antigovernment protests. He participated in the same small WhatsApp groups dedicated to sharing memes, jokes and plans for protests. After some small talk, the stranger asked Mr. Sztyglic to send him photos from a recent event.
By the next day, Mr. Sztyglic had sent dozens of photos from a recent protest in his small village in northern Israel to an account run by Iranians.
“He kept messaging me, asking for more photos of the protests, which he then reposted and shared in different places,” Mr. Sztyglic said. “I was helping him gain an audience for himself, and to reach other Israeli activists.”
Mr. Sztyglic eventually grew suspicious, he said, and began to wonder if the account was being run by Israeli intelligence agents looking to gain information about the protest movement. He did not suspect that Iranian agents were running the account until FakeReporter researchers told him, he said.
Orna Naor, a photographer from Tel Aviv, received a similar message from a stranger calling himself Adam. She corresponded with the account for months over Telegram and Instagram, and he offered to publish her photos from the Israeli protest movement on his account.
“Occasionally when we messaged, he used strange words or bad grammar, but honestly so many young Israelis do the same these days,” said Ms. Naor, 61, who added that she had regularly sent Adam photos and videos from the protests.
The Iranians were caught after they had spent weeks to months in many of the groups. Suspicious of their poor grammar and resistance to speaking over the phone or meeting in person, several people reported the accounts to FakeReporter.
A Shin Bet officer told The Times that it had opened its own investigation into the Iranian activity after FakeReporter brought it to the intelligence agency’s attention. Representatives for Israel’s government and Shin Bet did not respond to requests for comment.
A spokesman for Twitter said the company regularly monitored and removed state actors participating in coordinated campaigns. Telegram did not respond to a request for comment.
The move to smaller messaging groups reminded Mr. Schatz and Mr. Ben Itzhak, the former Israeli intelligence agent, of what was happening among the far right in the United States. As Facebook, Twitter and other platforms have kicked off leaders of far-right movements, the leaders have been forming groups on messaging apps, such as Telegram, where they can communicate to their followers.
Mr. Ben Itzhak, who used to recruit foreign spies and assets, called it “a perfect op.”
“From the point of view of a former handler, who would look for people to give us intelligence, I can see how smart a move this is,” he said. “It is strange to now be on the receiving end of this.”
Source » trackpersia